onboard.yml

name: Score a feed (on-demand)

# Self-serve instant onboarding (docs/expansion.md A3). When someone opens a
# "score-request" issue from the issue form, score the feed they pasted with
# `scorecard try` and comment the scorecard back, then close the issue. GitHub
# Actions is the on-demand compute, so the flow stays serverless.
#
# The issue body is untrusted input. It is passed to the parser through an
# environment variable and written to a file, never interpolated into a shell
# command, and the parser accepts only an http(s) URL. The feed download goes
# through the pipeline's SSRF-guarded fetch.

on:
  issues:
    types: [opened, labeled]

permissions:
  contents: read
  issues: write

jobs:
  score:
    if: contains(github.event.issue.labels.*.name, 'score-request')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          distribution: temurin
          java-version: "17"
      - uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
        with:
          python-version: "3.12"

      - name: Parse the feed URL from the issue
        id: parse
        working-directory: pipeline
        env:
          ISSUE_BODY: ${{ github.event.issue.body }}
        run: |
          printf '%s' "$ISSUE_BODY" > issue-body.txt
          if ! uv run scorecard onboard --body-file issue-body.txt --out request.json; then
            echo "ok=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          {
            echo "ok=true"
            echo "url=$(jq -r .url request.json)"
            echo "name=$(jq -r .name request.json)"
          } >> "$GITHUB_OUTPUT"

      - name: Score the feed
        if: steps.parse.outputs.ok == 'true'
        working-directory: pipeline
        env:
          FEED_URL: ${{ steps.parse.outputs.url }}
          FEED_NAME: ${{ steps.parse.outputs.name }}
        run: |
          # `try` exits non-zero only on a scoring failure here (no thresholds
          # set), so let a failure fall through to the "couldn't score" comment.
          uv run scorecard try "$FEED_URL" --name "$FEED_NAME" --comment comment.md || true
          if [ ! -f comment.md ]; then
            printf '%s\n' \
              "We could not score that feed. Check that the link points straight to a GTFS .zip and is reachable, then open a new request." \
              > comment.md
          fi

      - name: Comment the scorecard back
        if: always()
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const fs = require('fs');
            const ok = '${{ steps.parse.outputs.ok }}' === 'true';
            let body;
            if (ok && fs.existsSync('pipeline/comment.md')) {
              body = fs.readFileSync('pipeline/comment.md', 'utf8');
            } else {
              body = "We could not find a GTFS feed URL in this request. Please open a new one from the form and paste a direct link to your feed .zip.";
            }
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body,
            });
            await github.rest.issues.update({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              state: 'closed',
            });